docs(runbook): corrections from the v0.67-0.69 media pass - #831
Conversation
- Positive-control every verification grep. A grep returning nothing is two results wearing one face — absent, or a broken pattern. One check reported a page had zero images; the page was fine and the pattern was too narrow. - Cloudflare serves inconsistently mid-propagation: three identical fetches of one page returned 1, 1, 0. Fetch the asset URL directly rather than sampling the page harder. - A detection pattern is content. An early capture.mjs carried a private dev domain inside its own leak-detection regex, so the tool written to stop that string being published would have published it. That is why PADDOCK_LEAK_EXTRA exists, and the README now says so. - Corrects the 127.0.0.1 baseline, which summed to 52 while claiming 46. It is 39 in the docs subtree + 7 in README.md.
|
Superseded by #833, which is a strict superset of this branch: byte-identical runbook plus a 21-line record of what actually happened when the stale-build check was run at v0.69 (it passed first time — but only because the rig's existing checkout was already replaced; the rig's clone was parked pre-redesign). That empirical note is the most useful paragraph in the change, so #833 is the one to review. Closing to leave a single runbook PR from this lineage. |
This branch and #830/#831 each had material the other lacked, so merging any two would conflict and merging one would silently drop the other's content. Folded here so ONE runbook PR carries everything: - Positive-control every verification grep. A grep returning nothing is two results wearing one face — absent, or a broken pattern. - Cloudflare serves inconsistently mid-propagation; fetch the asset URL directly rather than sampling the page harder. - A detection pattern is content: an early capture.mjs carried a private dev domain inside its own leak-detection regex, so the tool written to stop that string being published would have published it. This branch's per-file 127.0.0.1 table is kept over #830's two-row summary — same numbers (46 = 39 site + 7 README), more useful breakdown. #830 becomes rig-tools-only; #831 is byte-identical to #830's runbook half.
|
Closing as superseded by #832. This branch's They were not, however, duplicates of each other: #832 carried ~180 lines this branch never had — verifying an auditor's negative findings, archive screenshots showing the old UI being correct rather than stale, off-limits lists going stale mid-pass, and counting at the end when your own PR edits what you are counting. Merging any two of the three would have conflicted; merging one would have silently dropped the other's content. Resolved by folding this content into #832, which now carries all of it:
#832 keeps its per-file Final split: #829 captures · #830 rig tooling · #832 runbook. Nothing from this branch is lost. |
The last-but-one figure was stale before it was pushed: the commit that recorded it (#778) also closed two README gaps, one of which added the seventh 127.0.0.1. That is not drift afterwards — it is the recording PR invalidating its own count. Last item outstanding from the #830/#831/#832 reconciliation; everything else those branches carried is already here.
1 participant
Eight corrections to
DOCS-UPDATE-RUNBOOK.md, each one something that cost this pass real time or nearly produced a wrong result.The two that would have cost a whole pass
The stale-build trap. The rig served
dist/from a clone that predated the visual redesign. Restart it without rebuilding and every "re-shot" frame is the old UI — and nothing tells you: the rig comes up, the seed passes, the leak scan passes, every shot succeeds. The only tell is a design nobody examines while concentrating on framing. The runbook now carries the one-navigation check: open/configand confirm the Appearance section with four theme cards, which cannot exist on any build before75c3935, and which tests the served bundle rather than the git state of a directory.The
127.0.0.1baseline was both stale and self-contradictory. It read 38; a later revision said 46 for the docs subtree and then added "plus 6 inREADME.md" — summing to 52 against a real total of 46. Recounted and split: 39 docs + 7 README = 46. This matters more than it looks: the baseline exists so you can subtract it and investigate the remainder, so a baseline that overcounts is exactly how a genuine new leak hides inside an expected one.What a design release changes about a docs pass
Normally docs drift is per-page and recency is a useful hint. A design release invalidates every UI-bearing image simultaneously, and recency stops being evidence at all — the previous pass's seven stills were merged 41 minutes before the first design commit. Age was never the criterion; what landed after them was.
Verification hygiene
\|alternation undergrep -E, where it is a literal. The control (Cloudflare, known present, no alternation) matched, which is what exposed it./procandssdo not work from a keeper here — we run in a container and see only our own netns, sossreports no listening socket whilecurlgets a 200. Prove instance identity from the API's own contents (/api/instance-config→dataDir,driveMode), not from the process table.capture.mjscarried this box's private dev domain inside its own leak-detection regex — the tool written to stop that string being published would have published it. Hence$PADDOCK_LEAK_EXTRA.Rig fragility
The projects tree must be on persistent storage, and the projects tree and the data dir must be wiped together or not at all. Half a wipe leaves job records describing chats whose transcripts are gone, and that renders into the screenshots as a subtly broken instance.
Verification
DOCS-UPDATE-RUNBOOK.mdis at the repo root and therefore outside thewebsite/**CI path filter, so this PR gets no docs build — the site build is not affected by it either way. Built locally regardless:npm run buildinwebsite/exits 0, 52 pages. Markdown-only, no site content changed, no links added.Docs-only: no changeset, no version bump.